【摘要】 基板管理控制器(baseboard management controller,BMC)是服务器远程管理组件,具有极高的系统权限,其固件的安全性问题需要重视.目前,由于良好的兼容性、较高的开放性以及较短的开发周期,以Open BMC为代表的开源BMC固件备受青睐.面对固件动态分析存在的计算资源有限、执行环境复杂等问题,模糊测试技术结合固件仿真可以有效完成对固件的脆弱性分析.然而,现有工具主要针对简单闭源嵌入式固件设计,不能良好地应用到结构复杂的BMC固件上.面向开源BMC固件,提出了一种内生模糊测试框架BMCfuzz,实现了对通用程序分析工具的支持.该框架依托全系统仿真,将通用模糊测试工具直接部署到仿真固件中,绕开复杂仿真环境直接面向固件程序工作.同时,框架充分利用开源特性,通过源代码插桩方式提升模糊测试效率.对于难以仿真的复杂网络服务程序,提出了一种简单的生成模糊网络数据包注入方式处理模糊数据输入,使其能够更好地仿真与分析.实验表明,与二进制插桩方式相比,该框架的执行效率提升了12.1倍,代码覆盖率提升了6.17倍,具有更好的测试性能.更多还原

【Abstract】 The baseboard management controller(BMC) is a remote management component of servers with high system privileges,and its firmware security is crucial.Currently,open-source BMC firmware,such as OpenBMC,is favored due to its good compatibility,high openness,and shorter development cycles.Facing challenges such as limited computational resources and complex execution environments in firmware dynamic analysis,fuzzing technology combined with firmware emulation can effectively perform vulnerability analysis.However,existing tools mainly target simple closed-source embedded firmware and are not well-suited for the complex structure of BMC firmware.This paper presents a build-in fuzzing framework,BMCfuzz,tailored for open-source BMC firmware,which supports general-purpose program analysis tools.The framework relies on full system emulation,allowing general-purpose fuzzing tools to be directly deployed in the emulated firmware,bypassing the complex emulation environment and directly working on firmware programs.Additionally,the framework leverages open-source features to enhance fuzzing efficiency through source code instrumentation.For complex network service programs that are difficult to emulate,this paper proposes a simple method for generating fuzzed network packet injections to handle fuzzed data input,enabling better emulation and analysis.Experimental results show that the framework’s execution efficiency is improved by 12.1 times,and code coverage is increased by 6.17 times compared to binary instrumentation methods,demonstrating better testing performance.更多还原